First Action for EDR Alert Showing Encrypted Archives and SMB Connections: Isolate with Network Containment
A SOC analyst receives an EDR alert showing a finance laptop creating encrypted archives and then attempting SMB connections to several internal file shares. The user is still logged in, and the business wants to stop possible spread without destroying volatile evidence. What should the analyst do first?
Quick Answer
The answer is to isolate the endpoint from the network using the EDR containment feature. This is correct because containment stops the encrypted archives from being exfiltrated over SMB connections while preserving all running processes, memory, and disk state—critical for retaining volatile evidence like active malware processes and network connections. On the Security+ SY0-701 exam, this scenario tests your understanding of incident response procedures, specifically the priority of stopping lateral movement without destroying forensic data. A common trap is to shut down the machine or kill processes, which would wipe out volatile evidence; instead, remember that EDR containment is a surgical network block that leaves the endpoint frozen for analysis. Memory tip: “Contain, don’t kill—preserve the spill.”
⚠ Common exam trap
Many candidates confuse 'stopping the spread' with 'destroying evidence,' and choose power-off or reimage, failing to recognize that containment in EDR is designed specifically to halt network propagation while preserving forensic data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the endpoint from the network using the EDR containment feature.
The EDR containment feature isolates the endpoint from the network while preserving all running processes, memory, and disk state. This stops the encrypted archives from being exfiltrated via SMB and prevents lateral movement, but keeps volatile evidence (e.g., active malware processes, network connections) intact for forensic analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Power off the laptop immediately to stop all activity.
Why it's wrong here
Powering off erases volatile memory, including running processes, network connections and encryption keys needed for investigation. It is tempting because it instantly halts all activity, and it would be correct in a scenario where containment outweighs evidence preservation, such as destructive malware with no forensic requirement.
- ✓
Isolate the endpoint from the network using the EDR containment feature.
Why this is correct
EDR network containment severs the host's connections while leaving the machine running, halting lateral SMB spread to file shares and preserving volatile memory, running processes and logged-on session state. That satisfies both the stop-spread and evidence-preservation constraints before any remediation.
- ✗
Reimage the laptop from a gold image as soon as possible.
Why it's wrong here
Reimaging destroys volatile and disk evidence before containment is even confirmed, and the malware may already have reached the file shares. It is tempting because rebuilding from a gold image guarantees a clean host, and it would be correct after evidence collection and eradication are complete.
- ✗
Disable the user account in Active Directory and wait for the malware to stop.
Why it's wrong here
Disabling the account does not terminate the already-running malicious process, which continues encrypting and attempting SMB connections under the logged-in session. It is tempting because account lockout is the standard response to compromised credentials, and it would be correct if the evidence pointed to credential misuse rather than active malware.
Go deeper
Related to this question
Learn chapter
Alert Triage and Investigation
Key term
SMB
SMB is a network file-sharing protocol that allows applications to read, write, and request services from server programs in a computer network.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,030 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC analyst reviews an EDR alert showing powershell.exe launched with an encoded command, then immediately connected to an unfamiliar IP address and spawned rundll32.exe. The user is still logged in and the machine may still contain evidence needed for investigation. Which two actions should the analyst take first to contain the incident while preserving evidence? Select two.
hard- ✓ A.Isolate the endpoint using EDR network containment or a quarantine policy.
- ✓ B.Disable the user account and revoke active sessions or tokens for that identity.
- C.Reboot the workstation immediately to clear any malicious process from memory.
- D.Run a full vulnerability scan before taking any other action.
- E.Delete the suspicious email from the mailbox to remove the original payload.
Why A: Isolating the endpoint via EDR network containment or quarantine policy immediately stops the malicious process from communicating with the command-and-control (C2) server at the unfamiliar IP address, preventing data exfiltration and lateral movement. This action preserves the volatile evidence in memory (e.g., the spawned rundll32.exe process) and on disk, allowing forensic analysis without the risk of the attacker destroying evidence remotely.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.